docker Zero: The Image That Was Already Clean
Chainguard Hummingbird scans at zero findings in both layers. It was asked to be fixed anyway, so it was re-verified from its digest instead: 0 OS, 0 app, still booting in 8s, still non-root. The interesting part is why rebuilding a clean image would have been the wrong move.